You are the global administrator of an organization with a Microsoft 365 E5 subscription. Because of the presence of sensitive data in your company’s MS Teams groups and channels, you want to prevent enterprise data from leaving the application. What should you do?

Answer options:

A.From Azure AD, create a conditional access policy.
B.From Microsoft Endpoint Manager, create an App protection policy.
C.From Microsoft Endpoint Manager, create an App configuration policy.
D.From Microsoft 365 security & compliance center, create an eDiscovery core case.

Correct Answer: B 
You can control your organizational data by creating an app protection policy. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app. 

Option A is incorrect. You need an app protection policy to control your organization`s data within the app. But you can require an app protection policy and an approved client app for cloud app access with Conditional Access.
Option C is incorrect. App configuration policy lets you assign configuration settings to a policy that is assigned to end-users before they run the app. It does not protect your data.
Option D is incorrect. eDiscovery is a tool organizations can use to search and export content in Microsoft 365 and Office 365.
Reference:
To know more about application protection policies, please refer to the link below: 

https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy